evolcore 0.0.25 → 0.0.27

package/dist/core/auth/agent-delegation.js

@@ -1,9 +1,22 @@
+import { assertAgentPolicyAuthorization } from '../role/runtime-policy.js';
 import crypto from 'crypto';
 import { authorizeOperation, buildAuthSubject } from './auth-gateway.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
 import { logger } from '../../utils/logger.js';
 export const AGENT_DELEGATION_TOKEN_ENV = 'EVOLCORE_DELEGATION_TOKEN';
+export const CODEX_SESSION_TOKEN_ENV = 'EVOLCORE_CODEX_SESSION_TOKEN';
 export const AGENT_DELEGATION_COMMAND_TTL_MS = 5 * 60_000;
+/**
+ * Resolve the credential carried by an EC CLI process. A live task token has
+ * priority; persistent Codex threads fall back to their session credential.
+ */
+export function readDelegationCredential(env = process.env) {
+    const taskToken = env[AGENT_DELEGATION_TOKEN_ENV]?.trim();
+    if (taskToken)
+        return taskToken;
+    const sessionToken = env[CODEX_SESSION_TOKEN_ENV]?.trim();
+    return sessionToken || undefined;
+}
 export class AgentDelegationRegistry {
     runtimeEpoch = crypto.randomBytes(16).toString('hex');
     grantsByHash = new Map();
@@ -24,6 +37,13 @@ export class AgentDelegationRegistry {
         return token;
     }
     validate(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, true);
+    }
+    /** Authenticate a CLI context lookup without spending its approved operation. */
+    validateForContext(token, sessionId, commandHash) {
+        return this.validateToken(token, sessionId, commandHash, false);
+    }
+    validateToken(token, sessionId, commandHash, consumeApproval) {
         if (!token) {
             return {
                 ok: false,
@@ -37,10 +57,19 @@ export class AgentDelegationRegistry {
         if (grant
             && grant.sessionId === sessionId
             && this.activeHashBySession.get(sessionId) === tokenHash) {
+            if (grant.executionIdentity?.source === 'agent-policy') {
+                try {
+                    assertAgentPolicyAuthorization(grant.executionIdentity);
+                }
+                catch {
+                    this.revokeSession(sessionId);
+                    return { ok: false, code: 'INVALID_DELEGATION', reason: 'Agent fullaccess policy was revoked', diagnosticCause: 'task_replaced' };
+                }
+            }
             return { ok: true, grant };
         }
         const approved = commandHash
-            ? this.consumeApprovedCommand(tokenHash, sessionId, commandHash)
+            ? this.readApprovedCommand(tokenHash, sessionId, commandHash, consumeApproval)
             : undefined;
         if (approved)
             return { ok: true, grant: approved };
@@ -66,11 +95,12 @@ export class AgentDelegationRegistry {
         const grant = activeTokenHash ? this.grantsByHash.get(activeTokenHash) : undefined;
         if (!grant || grant.taskId !== input.taskId)
             return false;
-        if (!input.carrierToken || !isDelegationCommandHash(input.commandHash))
+        const sessionToken = input.sessionToken ?? input.carrierToken;
+        if (!sessionToken || !isDelegationCommandHash(input.commandHash))
             return false;
         this.deleteExpiredApprovedCommands();
-        const carrierTokenHash = hashDelegationToken(input.carrierToken);
-        const key = approvedCommandKey(carrierTokenHash, input.sessionId, input.commandHash);
+        const sessionTokenHash = hashDelegationToken(sessionToken);
+        const key = approvedCommandKey(sessionTokenHash, input.sessionId, input.commandHash);
         const existing = this.approvedCommands.get(key);
         const ttlMs = Math.max(1, Math.min(input.ttlMs ?? AGENT_DELEGATION_COMMAND_TTL_MS, AGENT_DELEGATION_COMMAND_TTL_MS));
         this.approvedCommands.set(key, {
@@ -105,10 +135,10 @@ export class AgentDelegationRegistry {
         this.activeHashBySession.delete(sessionId);
         this.deleteApprovedCommandsForSession(sessionId);
     }
-    consumeApprovedCommand(carrierTokenHash, sessionId, commandHash) {
+    readApprovedCommand(sessionTokenHash, sessionId, commandHash, consume) {
         if (!isDelegationCommandHash(commandHash))
             return undefined;
-        const key = approvedCommandKey(carrierTokenHash, sessionId, commandHash);
+        const key = approvedCommandKey(sessionTokenHash, sessionId, commandHash);
         const approved = this.approvedCommands.get(key);
         if (!approved)
             return undefined;
@@ -124,10 +154,12 @@ export class AgentDelegationRegistry {
             this.approvedCommands.delete(key);
             return undefined;
         }
-        if (approved.remainingUses <= 1)
-            this.approvedCommands.delete(key);
-        else
-            approved.remainingUses--;
+        if (consume) {
+            if (approved.remainingUses <= 1)
+                this.approvedCommands.delete(key);
+            else
+                approved.remainingUses--;
+        }
         return grant;
     }
     deleteExpiredApprovedCommands() {
@@ -216,8 +248,10 @@ function isValidFullAccessExecutionIdentity(identity) {
         || identity.processRole !== 'fullaccess-run'
         || identity.dataScope !== 'daemon')
         return false;
-    if (identity.source === 'fullaccess-command') {
-        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0;
+    if (identity.source === 'fullaccess-command' || identity.source === 'agent-policy') {
+        return typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
+            && (identity.source !== 'agent-policy'
+                || (typeof identity.agentAid === 'string' && identity.agentAid.length > 0));
     }
     return identity.source === 'trigger'
         && typeof identity.authorizedBy === 'string' && identity.authorizedBy.length > 0
@@ -228,8 +262,8 @@ function isValidFullAccessExecutionIdentity(identity) {
 function hashDelegationToken(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
 }
-function approvedCommandKey(carrierTokenHash, sessionId, commandHash) {
-    return JSON.stringify([carrierTokenHash, sessionId, commandHash]);
+function approvedCommandKey(sessionTokenHash, sessionId, commandHash) {
+    return JSON.stringify([sessionTokenHash, sessionId, commandHash]);
 }
 function isDelegationCommandHash(value) {
     return /^[a-f0-9]{64}$/.test(value);

package/dist/core/auth/auth-gateway.js

@@ -70,6 +70,7 @@ export function buildAuthSubject(input) {
         identity: input.identity ?? roleToSessionIdentity(role === 'none' ? null : role),
         isDaemonOwner,
         fromControlChannel: !!input.fromControlChannel,
+        ecwebManagement: input.ecwebManagement === true && isTrustedDaemonOwner && input.fromControlChannel === true,
         allowAccess: processRole !== 'none' || (suppliedRole
             ? checkRoleAccess(suppliedRole, input.selfAid)
             : roleDetail.allowAccess && checkRoleAccess(role, input.selfAid)),
@@ -114,6 +115,7 @@ export function authorizeOperation(params) {
         return access;
     }
     const ctx = {
+        principalId: params.subject.principalId,
         intent: params.intent,
         actorId: params.subject.actorId,
         channel: params.subject.channel,

package/dist/core/auth/authorization-audit.js

@@ -2,7 +2,7 @@ import { logger } from '../../utils/logger.js';
 import { LogWriter } from '../../utils/log-writer.js';
 import { resolvePaths } from '../../paths.js';
 import crypto from 'node:crypto';
-import { buildAuthorizationEventKey, buildToolLifecycleEventKey } from '../audit/event-key.js';
+import { buildAuthorizationEventKey, buildToolLifecycleEventKey, normalizeToolCorrelation } from '../audit/event-key.js';
 import { normalizeExecutionPermissionMode } from '../permission/mode.js';
 export function auditCommandAuthorization(event) {
     const shouldAudit = event.source === 'menu.cli' ||
@@ -14,6 +14,8 @@ export function auditCommandAuthorization(event) {
         event.operation === 'permission.runtime' ||
         event.operation.startsWith('fullaccess.') ||
         event.operation.startsWith('role.') ||
+        event.operation === 'file.root.storage' ||
+        event.operation.startsWith('file.storage.') ||
         event.operation === 'cli.exec.raw';
     if (!shouldAudit)
         return;
@@ -25,6 +27,8 @@ export function auditFullAccessEvent(input) {
         || input.event === 'fullaccess.trigger.deescalated';
     const executionEvent = input.event === 'fullaccess.execution.started'
         || input.event === 'fullaccess.execution.ended'
+        || input.event === 'fullaccess.agent-policy.execution.started'
+        || input.event === 'fullaccess.agent-policy.execution.ended'
         || input.event === 'fullaccess.trigger.execution.started'
         || input.event === 'fullaccess.trigger.execution.ended';
     // The scheduler triggers a run, but the executing subject is the task-bound
@@ -39,7 +43,7 @@ export function auditFullAccessEvent(input) {
         ts: Date.now(),
         callId: input.attemptId ?? input.runId ?? input.taskId ?? input.messageId,
         correlationId: input.runId ?? input.taskId,
-        source: input.source === 'trigger' ? 'agent-tool' : 'slash',
+        source: input.source === 'fullaccess-command' ? 'slash' : 'agent-tool',
         operation: input.event,
         // CommandScope has no separate daemon value; process is the closest
         // existing scope for daemon-owner authorization and keeps audit records
@@ -97,20 +101,11 @@ export function auditFullAccessEvent(input) {
  * denials otherwise only reach `logger.warn` and `TriggerExecutionAnomaly`.
  */
 export function auditToolPreflightDenial(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'preflight',
-        } : {}),
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'preflight',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'tool.preflight.deny',
         scope: 'filesystem',
@@ -138,29 +133,20 @@ export function auditToolPreflightDenial(input) {
         role: input.role ?? 'unknown',
         selfAid: input.selfAid,
         peerKey: input.peerKey,
-        requestId: input.requestId,
         taskId: input.taskId,
     });
 }
 /**
  * Emit one canonical, structured record for every Codex app-server approval
- * decision. The app-server's request id is the lifecycle key; method and
+ * decision. Prefer the tool call id over the approval request id; method and
  * decision source make policy, user, and infrastructure denials distinct.
  */
 export function auditCodexApprovalDecision(input) {
-    const lifecycleId = input.callId ?? input.correlationId ?? input.requestId;
     auditCommandAuthorization({
         ts: Date.now(),
-        ...(lifecycleId ? {
-            eventKey: buildToolLifecycleEventKey({
-                sessionId: input.sessionId,
-                callId: input.callId,
-                correlationId: input.correlationId,
-                requestId: input.requestId,
-            }),
-            eventPhase: 'approval',
-        } : {}),
-        callId: input.callId ?? input.correlationId ?? input.requestId,
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'approval',
+        ...normalizeToolCorrelation(input),
         source: 'agent-tool',
         operation: 'codex.approval',
         scope: input.toolName === 'PermissionGrant' ? 'agent' : 'filesystem',
@@ -172,8 +158,6 @@ export function auditCodexApprovalDecision(input) {
         errorCode: input.decision === 'deny'
             ? input.decisionSource === 'approval' ? 'USER_DENIED' : input.decisionSource === 'policy' ? 'POLICY_DENIED' : infrastructureErrorCode(input.policyCode)
             : undefined,
-        requestId: input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -204,6 +188,8 @@ export function auditPermissionDecision(input) {
     auditPermissionLifecycle({
         phase: 'final',
         requestId,
+        callId: input.callId,
+        correlationId: input.correlationId,
         sessionId: input.sessionId,
         agentAid: input.agentAid,
         agentName: input.agentName,
@@ -235,9 +221,7 @@ export function auditPermissionLifecycle(input) {
             requestId: input.requestId,
         }),
         eventPhase: input.phase,
-        callId: input.callId ?? input.requestId,
-        correlationId: input.correlationId ?? input.callId ?? input.requestId,
-        requestId: input.requestId,
+        ...normalizeToolCorrelation(input),
         sessionId,
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -279,6 +263,8 @@ export function auditPermissionLifecycle(input) {
 export function auditToolInfrastructureFailure(input) {
     auditCommandAuthorization({
         ts: Date.now(),
+        eventKey: buildToolLifecycleEventKey(input),
+        eventPhase: 'final',
         source: 'agent-tool',
         operation: 'tool.execution.blocked',
         scope: 'filesystem',
@@ -288,9 +274,7 @@ export function auditToolInfrastructureFailure(input) {
         errorCode: infrastructureErrorCode(input.policyCode),
         executed: false,
         executionState: 'blocked',
-        callId: input.callId,
-        correlationId: input.callId,
-        requestId: input.callId,
+        ...normalizeToolCorrelation(input),
         sessionId: input.sessionId ?? 'unknown',
         agentAid: input.agentAid ?? 'unknown',
         agentName: input.agentName,
@@ -300,8 +284,20 @@ export function auditToolInfrastructureFailure(input) {
         reason: input.reason,
         role: input.role ?? 'unknown',
         taskId: input.taskId,
-        argsSummary: input.occurrences && input.occurrences > 1
-            ? { occurrences: input.occurrences }
+        argsSummary: input.occurrences || input.sandboxFailure
+            ? {
+                ...(input.occurrences ? { occurrences: input.occurrences } : {}),
+                // Flat primitive fields survive the audit argument redactor and can
+                // be aggregated without reparsing (possibly truncated) stderr.
+                ...(input.sandboxFailure ? {
+                    sandboxFailureKind: input.sandboxFailure.kind,
+                    sandboxFailureObservation: input.sandboxFailure.observation,
+                    sandboxInitializationFailures: input.sandboxFailure.counters.total,
+                    sandboxApplySeccompFailures: input.sandboxFailure.counters.applySeccomp,
+                    ...Object.fromEntries(Object.entries(input.sandboxFailure.counters.byKind)
+                        .map(([kind, count]) => [`sandboxFailures_${kind}`, count])),
+                } : {}),
+            }
             : undefined,
     });
 }
@@ -333,23 +329,31 @@ function buildAuditRecord(event) {
                 : executed
                     ? (event.exitCode === undefined || event.exitCode === 0 ? 'completed' : 'failed')
                     : 'authorized');
-    const lifecycleId = event.callId ?? event.correlationId ?? event.requestId;
+    const ecwebRequestId = event.source === 'ecweb' ? event.ecwebRequestId : undefined;
+    const requestId = event.requestId ?? ecwebRequestId;
+    const correlationId = event.correlationId ?? event.callId ?? requestId;
+    const lifecycleId = event.callId ?? correlationId ?? requestId;
     return {
         ts: event.ts,
-        eventKey: event.eventKey ?? (lifecycleId
-            ? buildAuthorizationEventKey({
-                sessionId: event.sessionId,
-                callId: event.callId,
-                correlationId: event.correlationId,
-                requestId: event.requestId,
-                operation: event.operation,
-            })
-            : undefined),
+        eventKey: event.eventKey ?? (ecwebRequestId
+            ? `ecweb:${crypto.createHash('sha256').update(JSON.stringify([
+                ecwebRequestId, event.targetAgentAid ?? event.selfAid, event.operation,
+            ])).digest('hex').slice(0, 20)}`
+            : lifecycleId
+                ? buildAuthorizationEventKey({
+                    sessionId: event.sessionId,
+                    callId: event.callId,
+                    correlationId,
+                    requestId,
+                    operation: event.operation,
+                })
+                : undefined),
         eventPhase: event.eventPhase,
         callId: event.callId,
-        correlationId: event.correlationId ?? event.requestId,
-        requestId: event.requestId,
+        correlationId,
+        requestId,
         sessionId: event.sessionId,
+        ...(event.source === 'ecweb' && !event.sessionId ? { sessionScope: 'not_applicable' } : {}),
         agentAid: redactIdentifier(event.agentAid ?? event.selfAid),
         agentName: resolveAgentName(event),
         permissionMode: normalizeAuditPermissionMode(event.permissionMode),

package/dist/core/auth/operation-authorizer.js

@@ -1,18 +1,21 @@
 import { getRoleDefinition } from '../../config/roles.js';
 import { isManagementRole } from '../../config/builtin-roles.js';
-import { relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
+import { isUnsupportedBaseagentConfigField, relationFieldWriteOperation, resolveRoleFieldPermission, } from '../../config/config-field-policy.js';
 import { isResolvedConfigMutation, } from '../../config/resolved-config-op.js';
 import { normalizePeer } from '../model/config-scope.js';
 import { getOperationMeta } from './operation-catalog.js';
 import { formatPeerKey, parsePeerKey } from '../relation/peer-identity.js';
+import { sameGroupAid } from '../../aun/group/index.js';
 const DAEMON_OWNER_PROCESS_OPERATIONS = new Set([
     'agent.list',
     'agent.create',
+    'agent.initialize',
     'agent.delete',
     'agent.enable',
     'agent.disable',
     'system.restart',
     'system.upgrade',
+    'system.paircode',
     'gateway.read',
     'gateway.write',
     'stats.peers',
@@ -98,6 +101,12 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         && (resolvedConfigCommand.operationId !== operation || resolvedConfigCommand.commandScope !== intent.scope)) {
         return denyDecision(ctx, 'NOT_ALLOWED', 'Resolved config operation does not match the command intent', operation, intent.scope, opMeta.dangerous);
     }
+    if (resolvedConfigCommand?.kind === 'field'
+        && resolvedConfigCommand.configScope === 'agent'
+        && (resolvedConfigCommand.field === 'fullaccess' || resolvedConfigCommand.field.startsWith('fullaccess.'))
+        && resolvedConfigCommand.subcommand !== 'get') {
+        return denyDecision(ctx, 'NOT_ALLOWED', 'Agent fullaccess can only be configured in ECWeb Agent settings', operation, intent.scope, true);
+    }
     // A fullaccess task is deliberately a daemon-scoped runtime identity. It
     // still has to name a known operation and pass structural command parsing,
     // but relation/Agent role rules, source lists, and daemon-owner gates are
@@ -204,6 +213,14 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: 'self-agent-read',
         };
     }
+    // Cross-Agent reads are a management/control-plane capability. A custom
+    // role must not widen this boundary merely by granting itself agent.show.
+    if (operation === 'agent.show'
+        && !isCurrentAgentTarget(ctx)
+        && !isManagementRole(role)
+        && !hasDaemonOwnerRole(ctx)) {
+        return denyDecision(ctx, 'NOT_ALLOWED', `${operation} may only target the current Agent from a managed Agent task.`, operation, intent.scope, opMeta.dangerous, undefined, 'TARGET_SELF_ONLY');
+    }
     if (operation === 'agent.persona' && isCurrentAgentTarget(ctx)
         && (role === 'owner' || hasDaemonOwnerRole(ctx))) {
         return {
@@ -215,11 +232,30 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
             matchedRule: role === 'owner' ? 'agent-owner-persona' : 'daemon-owner-persona',
         };
     }
+    if (operation === 'agent.welcome') {
+        if (!isCurrentAgentTarget(ctx) || ctx.chatType !== 'private'
+            || (role !== 'owner' && !(role === 'admin' && intent.args.action === 'show'))) {
+            return denyDecision(ctx, 'NOT_ALLOWED', 'welcome requires the current Agent Owner in private (admin may read)', operation, intent.scope, opMeta.dangerous);
+        }
+        return {
+            allow: true,
+            operation,
+            scope: intent.scope,
+            role,
+            dangerous: opMeta.dangerous,
+            matchedRule: 'self-agent-welcome',
+        };
+    }
     if (resolvedConfigCommand) {
         const targetCheck = checkResolvedConfigTarget(ctx, resolvedConfigCommand);
         if (!targetCheck.ok) {
             return denyDecision(ctx, intent.scope === 'relation' ? 'ARGUMENT_MISMATCH' : 'SCOPE_MISMATCH', targetCheck.reason || 'Config target is outside the current task context', operation, intent.scope, opMeta.dangerous);
         }
+        if (resolvedConfigCommand.kind === 'field'
+            && resolvedConfigCommand.subcommand === 'get'
+            && isUnsupportedBaseagentConfigField(resolvedConfigCommand.field)) {
+            return denyDecision(ctx, 'UNSUPPORTED_FIELD', `Config field ${resolvedConfigCommand.field} is not supported by this version`, operation, intent.scope, opMeta.dangerous);
+        }
         const identityMutationCheck = checkManagementIdentityMutation(ctx, resolvedConfigCommand);
         if (!identityMutationCheck.ok) {
             return denyDecision(ctx, 'NOT_ALLOWED', identityMutationCheck.reason || 'Static management identities cannot be changed by this role', operation, intent.scope, opMeta.dangerous);
@@ -227,7 +263,9 @@ function authorizeCommandInternal(ctx, resolvedConfigCommand) {
         if (!isManagementRole(role) && intent.scope !== 'relation') {
             return denyDecision(ctx, 'SCOPE_MISMATCH', `Role ${role} may only access relation-scoped config`, operation, intent.scope, opMeta.dangerous);
         }
-        if (role === 'owner' && isCurrentAgentTarget(ctx)) {
+        if (role === 'owner'
+            && isCurrentAgentTarget(ctx)
+            && !isCrossRelationConfigRead(ctx, resolvedConfigCommand)) {
             return {
                 allow: true,
                 operation,
@@ -627,6 +665,19 @@ function checkConfigFieldPolicy(ctx, policy, resolvedConfigOp) {
     }
     return { ok: true };
 }
+function isCrossRelationConfigRead(ctx, command) {
+    if (!command || command.kind !== 'field' || command.subcommand !== 'get' || command.configScope !== 'relation') {
+        return false;
+    }
+    if (!command.peerKey || !ctx.peerKey)
+        return true;
+    try {
+        return normalizeRelationPeer(command.peerKey) !== normalizeRelationPeer(ctx.peerKey);
+    }
+    catch {
+        return true;
+    }
+}
 function checkResolvedConfigTarget(ctx, command) {
     if (command.kind === 'global' || command.configScope === 'process' || command.configScope === 'defaults') {
         return { ok: true };
@@ -642,7 +693,13 @@ function checkResolvedConfigTarget(ctx, command) {
         }
         return { ok: true };
     }
-    if (ctx.allowExplicitRelationTarget && ctx.role === 'owner') {
+    if (ctx.allowExplicitRelationTarget
+        && isManagementRole(ctx.role)
+        && command.kind === 'field'
+        && (command.operationId.startsWith('role.') || command.subcommand === 'get')) {
+        // Management reads may select another relation of this Agent. This only
+        // relaxes target matching; admin field grants/constraints are checked later.
+        // Ordinary config writes and whole-config commands remain current-relation only.
         if (!ctx.selfAid || !command.self || command.self !== ctx.selfAid) {
             return { ok: false, reason: 'Only the current agent relation can be targeted' };
         }
@@ -682,7 +739,8 @@ function checkCurrentRelation(ctx, resolvedConfigCommand) {
         return { ok: false, reason: 'Current relation context is required' };
     }
     try {
-        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)) {
+        if (normalizeRelationPeer(requestedPeer) !== normalizeRelationPeer(ctx.peerKey)
+            && !sameAunGroupRelation(ctx, requestedPeer, ctx.peerKey)) {
             if (ctx.intent.operation.startsWith('ec.group.')) {
                 const currentGroup = peerIdFromArg(ctx.peerKey);
                 const targetGroup = stringArg(ctx.intent.args.targetId) ?? peerIdFromArg(requestedPeer);
@@ -777,6 +835,20 @@ function collectStringValues(value, out) {
             out.add(item);
     }
 }
+function sameAunGroupRelation(ctx, requested, current) {
+    if (ctx.chatType !== 'group'
+        || (!ctx.intent.operation.startsWith('ec.group.') && !ctx.intent.operation.startsWith('ec.fs.')))
+        return false;
+    try {
+        const target = parsePeerKey(requested);
+        const relation = parsePeerKey(current);
+        return target.channelType === 'aun' && relation.channelType === 'aun'
+            && sameGroupAid(target.channelId, relation.channelId);
+    }
+    catch {
+        return false;
+    }
+}
 function checkOwnPeer(ctx) {
     const argPeer = stringArg(ctx.intent.args.peer);
     const argPeerKey = stringArg(ctx.intent.args.peerKey);
@@ -801,15 +873,16 @@ function checkOwnPeer(ctx) {
                 candidateKeys.add(`${legacyChannelType}::${argPeer}`);
         }
         return candidateKeys.has(expectedPeerKey)
+            || [...candidateKeys].some(key => sameAunGroupRelation(ctx, key, expectedPeerKey))
             ? { ok: true }
             : { ok: false, reason: 'Only the current group relation can be targeted' };
     }
     if (ctx.actorId) {
         if (requestedPeerId && requestedPeerId !== ctx.actorId) {
-            return { ok: false, reason: 'Only the actor peer can be targeted' };
+            return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerId) };
         }
         if (requestedPeerKeyId && requestedPeerKeyId !== ctx.actorId) {
-            return { ok: false, reason: 'Only the actor peer can be targeted' };
+            return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerKeyId) };
         }
     }
     if (!expectedPeerKey)
@@ -827,10 +900,20 @@ function checkOwnPeer(ctx) {
             candidateKeys.add(`${legacyChannelType}::${argPeer}`);
     }
     if (!candidateKeys.has(expectedPeerKey)) {
-        return { ok: false, reason: 'Only the actor peer can be targeted' };
+        return { ok: false, reason: ownPeerOnlyDenialReason(ctx, requestedPeerId ?? requestedPeerKeyId) };
     }
     return { ok: true };
 }
+function ownPeerOnlyDenialReason(ctx, requestedPeer) {
+    if (ctx.intent.operation !== 'ec.msg.send' && ctx.intent.operation !== 'ec.msg.file') {
+        return 'Only the actor peer can be targeted';
+    }
+    const currentPeer = ctx.actorId || peerIdFromArg(ctx.peerKey || '') || '当前私聊对端';
+    const target = requestedPeer || '指定目标';
+    return `当前托管会话只能联系当前私聊对端（${currentPeer}），不能联系第三方目标（${target}）。`
+        + ' 如果本次请求来自 handoff，请执行 ec handoff return <handoff-id> "<失败原因>"（已有命令）将失败原因反馈给原会话；'
+        + '否则请让目标先直接发起会话，或由 Agent owner 为当前角色配置允许 relay/第三方外联后再发送。';
+}
 function peerIdFromArg(value) {
     try {
         return parsePeerKey(value).channelId;